Wikipedia:Sockpuppet investigations

WP:RFCU redirects here. You may be looking for Wikipedia:Requests for comment/User conduct (WP:RFC/U), CheckUser policy (Wikipedia:CheckUser), or Wikipedia:Changing username (WP:CHU).

Welcome to Sockpuppet investigations (SPI), a centralized forum regarding suspicions of sock puppetry amongst users as well as any additional CheckUser requests.

Important notes

1. Before submitting a case, check that there isn't one already in progress using the search button at the bottom of this page.
2. Please provide evidence (with diffs and any reasonable deductions and impressions as a result) that show disruption or deception via IPs or accounts via sock puppetry. Cases without any diffs or that contain solely vague beliefs or assumptions will be declined for checkuser or even closed.
3. Remember to assume good faith when possible.
4. Consider notifying the suspected accounts by adding {{subst:socksuspectnotice|PUPPETMASTER}} ~~~~ to the bottom of their talk pages. Notification is not mandatory, and may, in some instances, lead to further disruption or provide a sockpuppeteer with guidance on how to avoid detection.
5. Keep it simple. Simple, concisely presented evidence leads to a quickly resolved case.

If you see a purported suicide note or threat of harm please email emergencywikimedia.org which is staffed at any time of the day and has the best tools to deal with these cases.

Quick CheckUser requests

If you need a CheckUser to review something, but it does not fall into the above categories, please see here for instructions.

Administrator's instructions

If any administrator wants to help out at SPI, but is unsure how to get started, please read Wikipedia:Sockpuppet investigations/SPI/Administrators instructions. If you need help with anything, please ask one of the active SPI clerks.

Submitting an SPI case

Create the case by replacing "SOCKMASTER" in the white box below with the user name of the oldest account (the "sockmaster"), or the previous case name, and then clicking the button under the box. For example, if the case name is about User:John Doe or a prior case is at Wikipedia:Sockpuppet investigations/John Doe, then you should enter Wikipedia:Sockpuppet investigations/John Doe in the white box, and then click the button under the box. You will be taken to the next page, where there is a form to fill out giving the details of your report. Note that this form should be used for both opening a case for the first time, as well as opening a new case for a previous sockmaster.

If CheckUser might be needed, change |checkuser=no to |checkuser=yes in the edit box.

Start or continue an SPI case here

See also

• SPI clerks and clerking
• List of indicator icons used at SPI
• Suspected sock puppets and Requests for checkuser – predecessors to SPI which both ceased as of January 2009
• The SPI bot's edits.

Case status summary

Open cases

Cases

Cases: Administrator Action Needed

Open cases: awaiting Checkuser processing

Cases in this section have an open request for Checkuser that is being processed. Any user may update or act on this case, and any patroller or clerk may decide the case. However it will not be closed if the Clerks believe any further action is needed.

• Endorsement or decline of Checkuser request may only be made by a Clerk or Checkuser.
• If your case is not showing up here, or this section seems out of date, please click the .

Awaiting clerk approval

Awaiting Checkuser

Quick Checkuser requests

This section is for CheckUser requests unrelated to sockpuppetry, such as:

• Underlying IPs for identification and blocking for a longer term than autoblock.
• Collateral damage checks for the informed hardblocking of IPs or ranges.
• IP block exemption checks before granting IPBE (or to confirm it is being used constructively).

For Threats of harm (to self or others) email emergencywikimedia.org (see the threats of harm page). Requests to investigate and confirm sockpuppetry should be listed in the sockpuppet section above. If such a request is posted here, it will be summarily delisted by a Clerk or CheckUser.

Copy the following template and paste it to the end of this page (quick link to edit) with a useful header and details, then sign using "~~~~" and click "save".

==== HEADER ==== {{SPIquick}}

173.242.117.83

This quick case is open.

• 173.242.117.83 (talk⁺ • tag • contribs • deleted contribs • logs • filter log • block user • block log • SUL • checkuser (log))

Hello, is the rangeblock on 173.242.112.0/20 still necessary? There is currently an unblock request on User talk:173.242.117.83. Thanks! Reaper Eternal (talk) 15:00, 7 March 2012 (UTC)

Hmm. The IP shows as belonging to a web-hosting company ([57]). The latest socks of the person the 173.242.112.0/20 rangeblock was intended to stop were also using a (different) web-host. This makes me uneasy, but I would appreciate further opinions from other checkusers. TNXMan 15:19, 7 March 2012 (UTC)

Only a month ago I said we shouldn't just rangeblock a webhost without direct cause. In light of recent events I've changed my opinion on this, and would now tend to handle webhost ranges much like open proxies (while being more liberal with IPBEs for named accounts). Amalthea 18:19, 8 March 2012 (UTC)

Archived cases

The following are old SPI cases, separated by month. This archival system was deprecated in February 2010.

2009
January	February	March	April
May	June	July	August
September	October	November	December

2010
January	February	March
April	May	June
July	August	September
October	November	December

(For help, see Wikipedia:Purge)